Skip to content
System hardening
ASD ISMISM-1926

ASD ISM 1926 Restrict identity servers to their designed role only

What it says

Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are only used for their designed role and no other applications or services are installed, unless they are security related.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Keep domain controllers, AD CS, AD FS and Entra Connect servers single-purpose. Nothing else gets installed on them unless it is security related.

This control says that four specific kinds of Microsoft identity servers must do one job and nothing else: Active Directory Domain Services (AD DS) domain controllers, Active Directory Certificate Services (AD CS) servers, Active Directory Federation Services (AD FS) servers and Microsoft Entra Connect servers. You do not install other applications or services on them. The only exception is software that is itself security related, such as endpoint protection or logging agents (other agents, such as backup software, only qualify where the organisation classifies them as security related and can justify that classification). It matters because these servers are the crown jewels of a Windows environment. A domain controller holds every account and password hash, AD CS issues the certificates the organisation trusts, AD FS signs the tokens that let people into cloud services, and Entra Connect holds the credentials that synchronise on-premises identities to the cloud. Every extra application on one of these hosts is extra attack surface: more code to patch, more services listening on the network, more local accounts and more chances for a vulnerability in something unrelated to hand an attacker control of the identity tier. It also blurs administration, because people who only need to manage the extra application end up with access to the identity server. Keeping the box single-purpose keeps the blast radius small and the hardening simple.

Why it matters

If unrelated applications or services run on domain controllers, AD CS, AD FS or Entra Connect servers, a compromise of any of those applications can become a compromise of the whole identity tier. An attacker who gets code execution through a web app, database or utility on a domain controller can extract the AD database and every credential in it, forge certificates from AD CS, mint federation tokens from AD FS, or steal the synchronisation credentials from Entra Connect and pivot into the cloud tenant. Extra software also means more patching, more outages when it misbehaves, and more people holding access to servers that should have the tightest administration in the organisation.

How to implement

  1. The identity platform owner writes a build and configuration standard stating that AD DS domain controllers, AD CS servers, AD FS servers and Entra Connect servers are single-purpose, and lists by name the security-related software (for example endpoint protection, logging and backup agents) that is permitted on them.

  2. Systems administrators inventory every in-scope server and use PowerShell (Get-WindowsFeature, Get-Package, Get-Service) or the configuration management tool to export installed roles, features, applications and services, then remove or relocate anything that is not the designed role or an approved security tool.

  3. The change manager adds a mandatory approval step for any software or Windows feature installation on the in-scope servers, so that a request to add anything not on the security allow list is refused or escalated to the identity platform owner.

  4. Systems administrators apply an application control or software restriction policy scoped to the identity servers so that only the designed role binaries and the approved security software can execute, and configure it to block and log anything else.

  5. The security operations team configures the SIEM or monitoring platform to alert when a new service, scheduled task, Windows feature or installed program appears on a domain controller, AD CS, AD FS or Entra Connect server, and reviews each alert against the allow list.

Keep it running

Day to day this control is about resisting convenience. The temptation is always there to put a file share, print service, DHCP, a monitoring web console, a scripting host or a "just for now" utility on a domain controller because it is always on and already joined to everything. The answer is no, and that answer needs to come from a written standard rather than from whoever is on shift.

Keep a maintained list of the in-scope servers (every AD DS domain controller, AD CS server, AD FS server and Entra Connect server) and a short, explicit allow list of security-related software that is permitted on them, with a stated reason for each item. Anything not on that list is a change that needs approval before installation. When new domain controllers or other identity servers are built, use the same build standard so they start clean. Review installed programs, Windows features, server roles and running services on these hosts regularly, and treat any unexpected item as an incident to investigate rather than something to quietly tidy up. When a security agent needs to go on, record it on the allow list so the next review does not flag it as unknown.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the standard or policy that governs what may be installed on domain controllers, AD CS, AD FS and Entra Connect servers.

    Look at

    Check that it names all four server types, states they are single-purpose, and defines what counts as security-related software with a specific allow list.

    Good evidence

    A current, approved document covers all four server types and lists the permitted security tools by name with a reason for each.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the current inventory of in-scope identity servers.

    Look at

    Compare it against the domain controller list from Active Directory, the certification authority list, the AD FS farm and the Entra Connect installations to see whether any servers are missing.

    Good evidence

    The inventory matches what is actually deployed, and every server has a named owner and build date.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for a recent export of installed programs, Windows roles and features, and running services from a sample of the in-scope servers.

    Look at

    Look for anything beyond the designed role and the approved security software, such as file or print services, DHCP, web applications, databases or admin utilities.

    Good evidence

    Only the designed role and allow-listed security software are present, and any exception has a documented approval.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask how software installation on these servers is controlled and monitored.

    Look at

    Look for an application control or software restriction policy scoped to the identity servers and for alerting on new services, scheduled tasks or installed programs.

    Good evidence

    Technical controls block unapproved software from executing, and alerts fire and are reviewed when something new appears.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for records of the last periodic review of installed software on the in-scope servers.

    Look at

    Check who did the review, when, what was found and what was done about any unexpected item.

    Good evidence

    Reviews happen on a defined schedule, findings are recorded, and removals or approvals are traceable through change records.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.8.9Configuration management for secure IT systemsPartially meets
  • A.8.19Secure software installation proceduresPartially meets
Essential Eight

ASD Essential Eight: 1 mapping

  • E8-AC-ML3.1Application control is implemented on non-internet-facing serversDepends on

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.